DRF expects a callable that takes no args instead of just an object with a `has_permission` method. it is silly.